The Problem: Meeting DORA's Demands
With DORA enforceable across the EU starting January 2025, your team has likely updated contracts, documented incident procedures, and classified third-party arrangements. Now, regulators want to see how these frameworks perform during an actual network intrusion.
The issue isn't with your policies; it's whether your Security Operations Center (SOC) can answer three critical questions during an active intrusion: What systems are communicating? What changed from normal behavior? Can you prove it within four hours?
Article 9 requires continuous monitoring of your ICT ecosystem. Article 10 demands swift anomaly detection with defined thresholds. Article 19 sets a four-hour clock for initial incident notification after classifying a major ICT-related incident. If your visibility stack can't connect endpoint alerts to network behavior and third-party access patterns, you're left reconstructing incidents from incomplete evidence under regulatory deadlines.
Network Detection and Response (NDR) closes that gap by capturing protocol-level communication data across your environment, including the spaces between managed endpoints, legacy systems, and unmanaged devices where adversaries move laterally.
What You Need Before Starting
Before deploying NDR, ensure you have:
Infrastructure Access: Span ports, network TAPs, or virtual mirroring configured on core switches, firewalls, and segment boundaries. You need visibility into east-west traffic between internal systems, not just north-south perimeter flows.
Log Aggregation: A SIEM or centralized logging platform where NDR can forward structured telemetry. Network evidence becomes actionable when correlated with endpoint, identity, and application logs.
Baseline Documentation: Asset inventory, network diagrams, and approved data flows for critical systems. NDR detects deviations from normal, so you need to define normal first.
Incident Response Runbooks: Defined escalation paths and classification criteria for what constitutes a major ICT-related incident under DORA. Your SOC needs to know when the four-hour notification clock starts.
Storage Capacity: Network telemetry generates volume. Plan for retention that supports forensic investigation and regulatory evidence requirements, typically 90 days minimum for financial institutions.
Step-by-Step Implementation
Step 1: Deploy Sensors at Critical Boundaries
Position NDR sensors where they can observe traffic between:
- Core banking systems and payment processors
- Internal applications and external third-party services
- User networks and backend infrastructure
- Data centers and cloud environments
Configure span ports or TAPs to mirror bidirectional traffic. For virtual environments, enable vSwitch port mirroring or use cloud-native packet capture APIs.
Step 2: Establish Behavioral Baselines
Run NDR in observation mode for two to four weeks. During this period, the platform learns:
- Normal communication patterns between systems
- Expected protocols, ports, and data volumes
- Typical connection timing and frequency
- Authorized external destinations
Document approved third-party connections explicitly. If your credit assessment vendor connects via API at 0300 UTC daily, that's your baseline. Connections at 0300 from unfamiliar internal hosts aren't.
Step 3: Configure Detection Rules
Set thresholds aligned to Article 10's anomaly detection requirements:
- Protocol violations (SMB traffic from a web server)
- Unusual connection timing (database queries during maintenance windows)
- Volume anomalies (10x normal data transfer from a payment application)
- New external destinations (production systems contacting unrecognized IPs)
- Lateral movement indicators (administrative protocols between user workstations)
Tune sensitivity based on your environment's noise level. Start conservative, then tighten as false positives decrease.
Step 4: Integrate with Existing Security Tools
Configure NDR to forward alerts and telemetry to your SIEM. Map NDR findings to existing alert categories:
- EDR detects suspicious process, NDR shows which systems that host contacted
- Identity system flags credential misuse, NDR reveals what the account accessed
- Firewall logs external connection, NDR provides protocol details and payload metadata
Build correlation rules that escalate when multiple signals converge. A single EDR alert is noise. EDR plus anomalous network behavior plus identity deviation is an incident.
Step 5: Define Incident Classification Triggers
Under Article 19, you have four hours after classifying a major ICT-related incident to submit initial notification. Create decision trees that map NDR findings to classification criteria:
- Confirmed command-and-control traffic from critical systems = major incident
- Lateral movement across payment infrastructure = major incident
- Data exfiltration from customer databases = major incident
- Reconnaissance activity contained to non-critical systems = monitor, may not meet threshold
Document these triggers in your incident response playbook so analysts don't debate classification under deadline pressure.
Validation: How to Verify It Works
Test 1: Simulate Lateral Movement
From a test workstation, attempt SMB or RDP connections to systems outside normal access patterns. NDR should flag the connection as anomalous and provide protocol details.
Test 2: Verify Third-Party Visibility
Review NDR logs for your critical third-party providers. Confirm you can see:
- Source and destination IPs
- Protocols and ports used
- Connection timing and duration
- Data volume transferred
If a vendor's activity doesn't appear in NDR telemetry, you have a visibility gap.
Test 3: Run Tabletop Incident
Walk your SOC through a scenario: "EDR alerts on a compromised endpoint. What network evidence do you need to scope the incident?" Analysts should be able to query NDR for:
- All systems the compromised host contacted
- Unusual protocols or ports used
- External destinations accessed
- Timeline of activity
If they can't answer those questions within 30 minutes, your integration needs work.
Test 4: Measure Response Time
From alert generation to incident classification, how long does it take your team to determine whether DORA's four-hour notification requirement applies? If the answer is longer than two hours, you're cutting it too close.
Maintenance: Ongoing Tasks
Weekly: Review high-fidelity alerts that didn't escalate to incidents. Are you seeing patterns that indicate tuning opportunities or emerging threats?
Monthly: Audit third-party network activity against contractual scope. If a vendor's connections have changed, investigate whether the change was authorized.
Quarterly: Revisit behavioral baselines after infrastructure changes, mergers, or new third-party integrations. Normal changes, and your detection thresholds should reflect current operations.
Annually: Test your ability to reconstruct a complex incident using only network evidence. Can you trace an attack path, identify affected systems, and document the timeline for regulatory reporting?
Network visibility isn't a compliance checkbox. It's the difference between telling regulators "we think the breach was contained" and "here's the protocol-level evidence showing exactly what the attacker accessed and when we stopped them."
